Part II:ARM Embedded Systems

ARM Embedded Systems• The ARM processor core is a key component of many

successful 32-bit embedded systems

• ARM cores are widely used in mobile phones, handheld

organizers, and a multitude of other everyday portable

consumer devices

• ARM1 prototype was first developed in 1985

• One of ARM’s most successful cores is the ARM7TDMI

known as its high code density and low power consumption

suitable for mobile embedded devices

The RISC Design Philosophy• The ARM core uses a RISC architecture

• RISC (Reduced Instruction Set Computer) is a design

philosophy aimed at delivering simple but powerful instructions

that execute within a single cycle at a high clock speed

• RISC concentrates on reducing the complexity of instructions

performed by the hardware it is easier to provide more

flexibility and intelligence in software rather than hardware

• Thus RISC design places greater demands on the compiler

The RISC Design Philosophy• The traditional complex instruction set computer (CISC)

relies more on the hardware for instruction functionality• Thus CISC instructions are more complicated

The RISC Design Philosophy• The RISC philosophy is implemented with four major design rules:

1. Instructions:• RISC processors have a reduced number of instruction classes• executed in a single cycle,• complex instructions are formed by combining simple instructions• the instruction is a fixed length allowing the pipeline to fetch future

instruction before decoding the current instruction• The instruction in CISC processors are often of variable size and take

many cycles to execute2. Pipeline:

• The processing of instructions is broken down into smaller units executed in parallel by pipelines

The RISC Design Philosophy2. Pipeline: (Cont.)

• Ideally, the pipeline advances by one step on each cycle for maximum throughput

• Instruction can be decoded in one pipeline stage• There is no need for an instruction to be executed by a

miniprogram called microcode as on CISC processors

3. Register:• RISC machines have a large general-purpose register set• Any register can contain either data or an address• Register acts as the fast local memory store for all data

processing operations• CISC processors have dedicated registers for specific purposes

The RISC Design Philosophy4. Load-Store architecture:

• The processor operates on data held in register• Separate load and store instructions transfer data between the

register bank and external memory• Memory accesses are costly separating memory accesses

from data processing provides an advantage since you can use data items held in the register bank multiple times without needing multiple memory accesses

• In a CISC design, data processing operations can act on memory directly

• These design rules allow a RISC processor to be simpler, and thus can operate at higher clock frequencies

Embedded System Hardware• Embedded system can control many different devices, from small

sensors found on a production line, to the real-time control system used on a NASA space probe

• All these devices use a combination of software and hardware components

Embedded System Hardware• The ARM processor controls the embedded device

• The ARM processor comprises a core (the execution engine that processes

instructions and manipulates data) plus the surrounding components that

interface it with a bus

• These components include memory management and caches

• Controllers coordinating important functional blocks of the system two

commonly found controllers are interrupt controller and memory controller

• The peripherals provide all the input-output capability external to the chip and are

responsible for the uniqueness of the embedded devices

• A bus is used to communicate between different parts of the device

ARM Processor Fundamentals• A programmer can think of an ARM core as functional units connected

by data buses• The arrows represent the flow of data, the lines represent the buses,

and the boxes represent either an operation unit or a storage area

ARM Processor Fundamentals• Data enters the processor core through the Data bus

• The data may be an instruction to execute or a data item

• For Von Neumann implementation of the ARM---data items and

instructions share the same bus

• For Harvard implementations of the ARM---two different buses are used

for data items and instructions

• The instruction decoder translates instructions before they are executed

each instruction executed belongs to a particular instruction set

• The ARM processor uses a load-store architecture it has two

instruction types for transferring data in and out of the processor

ARM Processor Fundamentals• Load instructions copy data from memory to registers in the core

• Store instructions copy data from registers to memory

• There are no data processing instructions that directly manipulate data in

memory data processing is carried out solely in registers

• Data items are placed in the register file a storage bank made up of

32-bit registers

• Since ARM core is a 32-bit processor, most instructions treat the

registers as holding signed or unsigned 32-bit values

• The signed extend hardware converts signed 8-bit and 16-bit numbers to

32-bit values as they are read from memory and placed in a register

ARM Processor Fundamentals• ARM instructions typically have two source registers, Rn

and Rm, and a single result or destination register, Rd• Source operands are read from the register file using the

internal buses A and B, respectively• The Arithmetic Logic Unit (ALU) or Multiply-Accumulate

Unit (MAC) takes the register values Rn and Rm from the A and B buses and computes a result

• Data processing instructions write the result in Rd directly to the register file

• Load and store instructions use the ALU to generate an address to be held in the address register and broadcast on the Address bus

ARM Processor Fundamentals• Register Rm alternatively can be preprocessed in the

barrel shifter before it enters the ALU• Together the barrel shifter and ALU can calculate a wide

range of expressions and addresses• After passing through the functional units, the result in Rd

is written back to the register file using the Result bus• For load and store instructions the incremented updates

the address register before the core reads or writes the next register value from or to the next sequential memory location

• The processor continues executing instructions until an exception or interrupt changes the normal execution flow

Registers• General-purpose registers hold either data or

an address• They are identified with the letter r prefixed to

the register number register 4 is given the label r4

• Registers available in user mode are shown as follows

Registers• The processor can operate in seven different modes (to be covered

shortly)• All the registers shown are 32 bits in size• There are up to 18 active registers: 16 data registers and 2 processor

status registers• The data registers are visible to the programmer as r0 to r15• The ARM processor has three registers assigned to a particular task

or special function1. Register r13 is traditionally used as the stack pointer (sp) and

stores the head of the stack in the current processor mode2. Register r14 is called the link register (lr) and is where the core

puts the return address whenever it calls a subroutine3. Register r15 is the program counter (pc) and contains the

address of the next instruction to be fetched by the processor

Registers• Depending upon the context r13 and r14 can also be used

as general-purpose registers• However, it is dangerous to use r13 as a general register when

the processor is running any form of operating system because operating systems often assume that r13 always points to a valid stack frame

• In ARM state the registers r0 to r13 are orthogonal any instruction that can apply to r0 can equally well apply to any other registers (some instruction treat some registers r13 and r14 in special way)

• There are two addition program status registers: current program status register (cpsr) and saved program status register (spsr)

Registers• The register file contains all the registers available to a programmer

which registers are visible to the programmer depend upon the current mode of the processor

• cpsr register is used to monitor and control internal operations• cpsr is a dedicated 32-bit register and resides in the register file

Registers• cpsr register is divided into four fields, each field has 8 bits

wide1. Flags2. Status3. Extension4. Control

• In the previous figure, the extension and status fields are reserved for future use

• The control field contains the processor mode, thumb state, and interrupt mask bits

• The flag field contains the condition flags• Some ARM processor cores have extra bits allocated J bit on

Jazelle-enabled processors which executes 8-bit instructions

Processor Modes• The processor mode determines which registers are

active and the access rights to the cpsr register itself• Each processor mode is either privileged or nonprivileged• A privileged mode allows full read-write access to cpsr• A nonpriviledged mode only allows read access to control

field in the cpsr but still allows read-write access to the condition flags

• ARM core processor provides seven processor modes: six privileged modes (abort, fast interrupt request, interrupt request, supervisor, system and undefined)

• And nonprivileged mode (user)

Processor Modes• The processor enters abort mode when there is a failed

attempt to access memory• Fast interrupt request and interrupt request modes correspond

to the two interrupt levels available on the ARM processor• Supervisor mode is the mode that the processor is in after

reset and is generally the mode that an operating system kernel operates in

• System mode is a special version of user mode that allows full read-write access to cpsr

• Undefined mode is used when the processor encounters an instruction that is undefined or not supported by the implementation

• User mode is used for programs and applications

Banked Registers

• The above figure shows all 37 registers in the register file• 20 registers are hidden from a program at different times

Banked Registers• These registers are called banked registers and are identified

by the shading in the diagram• They are available only when the processor is in a particular

mode• For example, abort mode has banked registers r13_abt,

r14_abt and spsr_abt• Banked registers of a particular mode are denoted by an

underline character post-fixed to the mode mnemonic or _mode

• Every processor mode except user mode can change mode by writing directly to the mode bits of the cpsr

• All processor modes except system mode have a set of associated banked registers that are a subset of the main 16 registers

Banked Registers• A banked register maps one-to-one onto a user mode register if you change processor mode, a banked register from the new mode will replace an existing register

• For example, when the processor is in the interrupt request mode the instructions you execute still access registers named r13 and r14

• However, these registers are the banked registers r13_irq and r14_irq

• The user mode registers r13_usr and r14_usr are not affected by the instruction referencing these registers

• A program still has normal access to the other registers r0 to r12

Banked Registers• The processor mode can be changed by a program that

writes directly to the cpsr (privileged mode) or by hardware when the core responds to an exception or interrupt

• The following exceptions and interrupts cause a mode change: reset, software interrupt, data abort, prefetchabort and undefined instruction

• Exceptions and interrupts suspend the normal execution of sequential instructions and jump to a specific location

Banked Registers• The above figure shows what happens when an interrupt forces a mode change

• The core changes from usermode to interrupt request mode

Banked Registers• The change of mode happens when an interrupt request

occurs due to an external device raising an interrupt to the processor core

• This change causes user register r13 and r14 to be banked• The user registers are replaced with r13_irq and r14_irq

respectively r14_irq contains the return address and r13_irqcontains the stack pointer for interrupt request mode

• There is also a new register appearing in interrupt request mode the saved program status register (spsr)

• spsr stores the previous mode’s cpsr cpsr is being copied into spsr_irq

Banked Registers• To return to user mode the special return instruction

instructs the core to restore the original cpsr from the spsr_irq and bank in the user register r13 and r14

• Note that there is no spsr available in user mode• The saving of the cpsr only occurs when an exception or

interrupt is raised• When power is applied to the core, it starts in supervisor

mode (privileged)• Starting in a privileged mode is useful since initialization

code can use full access to the cpsr to set up the stacks for each of the other modes

Banked Registers• The following table lists the various mode and the

associated binary pattern• The last column gives the bit patterns that represent each

of the processor modes in the cpsr

State and Instruction Sets• The state of the core determines which instruction set is

being executed• There are three instruction sets

1. ARM2. Thumb3. Jazelle

• The ARM instruction set is only active when the processor is in ARM state J and T bits in the cpsr are both 0

• When T = 1 and J = 0, the processor is in Thumb state• When T = 0 and J = 1, the processor is in the Jazelle state

State and Instruction Sets

Interrupt Masks• Interrupt masks are used to stop specific interrupt

requests from interrupting processor• There are two interrupt request levels available on the

ARM processor core1. Interrupt request (IRQ)2. Fast Interrupt request (FIQ)

• The cpsr has two interrupt mask bits, 7 and 6 (or I and F) which control the masking of IRQ and FIQ respectively

• The I bit masks IRQ when set to binary 1 and F bit masks FIQ when set to binary 1

Condition Flags• Condition flags are updated by comparisons and the

result of ALU operations (when using specific instruction) for ARM this is the S instruction suffix

• For example, if a SUBS subtract instruction results in a register value of zero then the Z flag in the cpsr is set

• This particular subtract instruction specifically updates the cpsr

• Some processor (including DSP extensions) had the Q bit indicates if an overflow or saturation has occurred

• This flag is “sticky” hardware only sets this flag, need to write to the cpsr directly to clear flag

Condition Flags• Most ARM instructions can be executed conditionally on

the value of the condition flag• These flags are located in the most significant bits in the

cpsr these bits are used for conditional execution

Condition Flags• The following figure shows a typical value for the cpsr with both DSP

extensions and Jazelle• When a bit is 0, the lower case letter is used and when a bit is 1, the

uppercase letter is used• Thus, the capital letter shows that the flag has been set • For interrupts the capital letter shows that the interrupt is disabled

Conditional Execution• Conditional execution controls whether or not the core will

execute an instruction• Most instructions have a condition attribute that determines if

the core will execute it based on the setting of the condition flag• Prior to execution, the processor compares the condition

attribute with the condition flags in the cpsr• If they match the instruction is executed; otherwise the

instruction is ignored• In ARM, condition attribute is postfixed to the instruction

mnemonic• When a condition mnemonic is not present, the default

behavior is to set it to always (AL) execute

Conditional Execution

Pipeline• A pipeline is the mechanism a RISC processor uses to execute

instruction• Using a pipeline speeds up execution by fetching the next

instruction while other instructions are being decoded and executed

• Fetch: loads an instruction from memory• Decode: identifies the instruction to be executed• Execute: processes the instruction and writes the instruction

back to a register

Pipeline

• The above figure shows a sequence of three instructions being fetched, decoded, and executed by the processor

• Each instruction takes a single cycle to complete after the pipeline is filled

• The three instructions are placed into the pipeline sequentially

Pipeline• In the first cycle the core fetches the ADD instruction from

memory• In the second cycle the core fetches the SUB instruction

and decodes the ADD instruction• In the third cycle, both SUB and ADD instructions are moved

along the pipeline• The ADD instruction is executed, the SUB is decoded, and

the CMP instruction is fetched• This procedure is called filling the pipeline • The pipeline allows the core to execute an instruction

every cycle

Pipeline• As the pipeline length increases, the amount of work done at each

stage is reduced allows the processor to attain higher operating frequency (increasing the performance)

• The system latency also increases it takes more cycles to fill the pipeline before the core can execute an instruction, and there can be data dependency between certain stages

• ARM9 core has five stages pipeline with a memory and writebackstage allows ARM9 to process faster than ARM7 13%

• The maximum core frequency attainable is also higher

Pipeline

• ARM10 increases the pipeline length by adding a sixth stage

• ARM10 can process 34% more faster than ARM7 processor core at higher latency cost

• Even though the ARM9 and ARm10 pipelines are different use the same pipeline executing characteristics as ARM7

• Code written for ARM7 can still be executed on an ARM9 and ARM10

Pipeline Executing Characteristics• The ARM pipeline has not processed an instruction until it

passes completely through the execute stage• Thus, ARM7 pipeline (with three stages) has executed an

instruction only when the fourth instruction is fetched• In the following figure, the MSR instruction is used to enable

IRQ interrupts only occurs once the MSR instruction completes the execute stage of the pipeline

• It clears the I bit in cpsr to enable the IRQ interrupts• Once the ADD instruction enters the execute stage of the

pipeline IRQ interrupt is enable

Pipeline Executing Characteristics

Pipeline Executing Characteristics

• The above figure shows the use of the pipeline and the program counter pc

• In the execute stage, the pc always points to the address of the instruction plus 8 bytes (plus 4 bytes for Thumb instruction)

• In other words, pc always points to the address of the instruction being executed plus two instructions ahead

Pipeline Executing Characteristics• There are three other characteristics of the pipeline worth

mentioning:1. Execution of a branch instruction or branching by the direct

modification of the pc causes the ARM core to flush its pipeline

2. ARM10 uses branch prediction to reduce the effect of a pipeline flush predicting possible branches and loading the new branch address prior to the execution of the instruction

3. An instruction in the execute stage will complete even though an interrupt has been raised Other instructions in the pipeline will be abandoned and the processor will start filling the pipeline from the vector table

Exceptions, Interrupts, and The Vector Table• When an exception or interrupt occurs, the processor sets the

pc to a specific memory address• The address is within a special address range called the vector

table• The entries in the vector table are instructions that branch to

specific routines designed to handle a particular exception or interrupt

• The memory map address 0x00000000 is reserved for the vector table a set of 32-bit words

• On some processors the vector table can be optionally located at a higher address in memory (starting at the offset 0xffff0000) Linux and Microsoft’s embedded products take advantage of this feature

Exceptions, Interrupts, and The Vector Table

• When an exception or interrupt occurs the processor suspends normal execution and starts loading instructions from the exception vector table

• Each vector table entry contains a form of branch instruction

Exceptions, Interrupts, and The Vector Table• Reset vector: the location of the first instruction executed

by the processor when power is applied the instruction branches to the initialization code

• Undefined instruction vector: used when the processor cannot decode an instruction

• Software interrupt vector: This is called when you execute a SWI instruction SWI instruction is frequently used as the mechanism to invoke an operating system routine

• Prefetch abort vector: occurs when the processor attempts to fetch an instruction from an address without the correct access permissions actual abort occurs in the decode stage

Exceptions, Interrupts, and The Vector Table• Data abort vector: similar to a prefetch abort but is raised

when an instruction attempts to access data memory without the correct access permissions

• Interrupt request vector: used by external hardware to interrupt the normal execution flow of the processor it can only be raised if IRQs are not masked in the cpsr

• Fast interrupt request vector: similar to the interrupt request but is reserved for hardware requiring faster response times it can only raised if FIQs are not masked in the cpsr

Core Extensions• A processor core usually have additional components

placed next to it• These components are for the purpose of improving

performance, managing resources, and provide extra functionality in handling particular applications

• There are three standard hardware extensions for ARM core1. Cache and tightly coupled memory2. Memory management3. Coprocessor Interface

Cache and Tightly Coupled Memory• The cache is a block of fast memory placed between main

memory and the core• It allows efficient fetches from some memory types• By using the cached, the processor core can run for the

majority of time without having to wait for data from slow external memory

• Most ARM-based embedded system use a single-level cache internal to the processor

• ARM has two forms of cache1. Cached attached to Von Neumann-style core2. Cached attached to Harvard-style core

Cache and Tightly Coupled Memory

• The above figure shows a simplified Von Neumann architecture with cache

• It combines both data and instruction into a single unified cached • The glue logic that connects the memory system to the AMBA bus is

called logic and control

Cache and Tightly Coupled Memory

• The above figure shows a simplified Harvard architecture with TCMs

• This architecture has separate caches for data and instruction

Cache and Tightly Coupled Memory• A cache provides an overall increase in performance but at the

expense of predictable execution• For real-time systems it is important that the code execution is

deterministic the time taken for loading and storing instructions or data must be predictable

• This is achieved using a form of memory called tightly coupled memory (TCM)

• TCM is fast SRAM located close to the core and guarantees the clock cycles required to fetch instruction or data

• This characteristic is critical for real-time algorithms requiring deterministic behavior

• TCM appear as memory in the address map and can be accessed as fast memory

Cache and Tightly Coupled Memory

• The above figure shows a simplified Harvard architecture with caches and TCMs

• By combining both technologies, ARM processor can have both improved performance and predictable real-time response

Memory Management• Embedded systems often use multiple memory devices• It usually necessary to have a method to help organize these

devices and protect the system from applications trying to make inappropriate access to hardware

• This feature is achieved with the assistance of memory management hardware

• ARM cores have three different types of memory management hardware1. No extensions providing no protection2. A memory protection unit (MPU) providing limited

protection3. A memory management unit (MMU) providing full

protection

Memory Management• Nonprotected memory is fixed and provides very little

flexibility normally used for small, simple embedded systems that require no protection from rogue applications

• MPUs employ a simple system that uses a limited number of memory regions

• These regions are controlled with a set of special coprocessor registers with specific access permissions

• This type of memory management is used for systems that require memory protection without a complex memory map

Memory Management• MMUs are the most comprehensive memory

management hardware available on ARM• The MMU uses a set of translation tables to provide fine-

grained control over memory• These tables are stored in main memory and provide a

virtual-to-physical address map as well as access permissions

• MMUs are designed for more sophisticated platform operating systems that support multitasking

Coprocessors• A coprocessor extends the processing features of a core by extending

the instruction set or by providing configuration registers• More than one coprocessor can be added to the ARM core via

coprocessor interface• The coprocessor can be accessed through a group of dedicated ARM

instructions that provide a load-store type interface• For example, coprocessor 15 the ARM processor uses coprocessor

15 registers to control the cache, TCMs, and memory management• The coprocessor can also be extended the instruction set by

providing a specialized group of new instructions

Coprocessors• There are a set of specialized instructions that can be

added to the standard ARM instruction set to process vector floating-point (VFP) operations

• These new instructions are processed in the decode stage of the ARM pipeline

• If the decode stage sees a coprocessor instruction it will be offered to the relevant coprocessor

• But if the coprocessor is not present or doesn’t recognize the instruction the ARM takes an undefined instruction exception, which allows the user to emulate the behavior of the coprocessor in software